[MESOS-8306] Restrict which agents can statically reserve resources for which roles

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.6.0
• Assignee: Yan Xu
• Reporter: Yan Xu
• Created: 06/Dec/17 19:00
• Updated: 06/Feb/18 08:19
• Resolved: 06/Feb/18 08:19

Description

In some use cases part of a Mesos cluster could be reserved for certain frameworks/roles. A common approach is to use static reservation so the resources of an agent are only offered to frameworks of the designated roles. However without proper authorization any (compromised) agent can register with these special roles and accept workload from these frameworks.

We can enhance the RegisterAgent ACL to express: agent principal foo is allowed to register with static reservation roles bar, baz; no other principals are allowed to register with static reservation roles bar, baz.